Never host arbitrary user-uploaded files on your site. Put them in a sandboxed domain (e.g. per-user-random-string.<yourdomain>-userdata.com). Being able to up

Never host arbitrary user-uploaded files on your site. Put them in a sandboxed domain (e.g. per-user-random-string.<yourdomain>-userdata.com). Being able to upload arbitrary files has enabled many many web security bypasses, with the result ranging from xss to csrf.